nginx.conf

events {
 }
http {
    server {
        listen PORT;

        location = /login {
            proxy_pass http://localhost:9090;
        }

        location = /auth {
            proxy_pass http://localhost:9090;
        }

        location = /logout {
            proxy_pass http://localhost:9090;
        }

        location = /validate {
        # forward the /validate request to Vouch Proxy
        proxy_pass http://localhost:9090/validate;
        # be sure to pass the original host header
        proxy_set_header Host $http_host;
        
        auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;
        auth_request_set $auth_resp_x_vouch_idp_idtoken $upstream_http_x_vouch_idp_idtoken;

        # these return values are used by the @error401 call
        auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt;
        auth_request_set $auth_resp_err $upstream_http_x_vouch_err;
        auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount;
        
        # Vouch Proxy only acts on the request headers
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";

        }
        
        # if validate returns `401 not authorized` then forward the request to the error401block
        error_page 401 = @error401;

        location @error401 {
            # redirect to Vouch Proxy for login
            return 302 SERVICE_URL/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
        }

        location / {
        auth_request /validate;
        # forward authorized requests to your service protectedapp.yourdomain.com
        proxy_pass  DST_SERVICE_URL;
        #proxy_set_header Host $host;
        auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;
        auth_request_set $auth_resp_x_vouch_idp_idtoken $upstream_http_x_vouch_idp_idtoken;
        proxy_set_header X_VOUCH_USER "User $auth_resp_x_vouch_user";
        proxy_set_header Authorization "Bearer $auth_resp_x_vouch_idp_idtoken";
        }
    }
}